Server-side Request Forgery (SSRF)

Overview Affected versions of this package are vulnerable to Server-side Request Forgery SSRF in the concatenateForRewrite method in JettyUtils when the management proxy is enabled - which it is in the default configuration. An attacker can manipulate the URL to redirect requests to an arbitrary...

Timing Attack

Jetty Utils is vulnerable to timing attacks. The library is vulnerable because it does not compare passwords, message digests and credentials in constant-time. This allows malicious users to use the timing of the request to progressively identify a valid passwords, message digests and credentials...